admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect Spike in AWS Security Hub Alerts for EC2 Instance

Browse Source
This commit is contained in:
root
2021-01-27 03:30:48 +00:00
parent 007d957e01
commit 30bb53bfbc
1 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+15 -12
View File
@@ -2,22 +2,22 @@ name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 3
date: '2021-01-26'
description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
description: This search looks for a spike in number of of AWS security Hub alerts
for an EC2 instance in 4 hours intervals
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
type: ESCU
references: []
author: Bhavin Patel, Splunk
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance
| bucket span=4h _time
| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest
| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
| eval threshold_value = 3
| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0)
| search isOutlier=1
| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg
| `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
_time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
as vendor_account values(vendor_region) as vendor_region values(severity) as severity
by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
| eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
* threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
known_false_positives: None
tags:
analytics_story:
@@ -29,3 +29,6 @@ tags:
- DE.AE
security_domain: network
asset_type: AWS Instance
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json